PT-2014-3099 · Json-C+3 · Json-C+3

Florian Weimer · Publicado 2014-04-08 · Atualizado 2024-06-15 · CVE-2013-6371

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions json-c versions prior to 0.12

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, by providing crafted JSON data that involves collisions, thus exploiting the hash functionality.

Recommendations For versions prior to 0.12, update to version 0.12 or later to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

ALT-PU-2014-1691

ALT-PU-2019-4163

ALT-PU-2020-2322

ALT-PU-2023-6481

ALT-PU-2023-6841

CVE-2013-6371

MGASA-2014-0175

OPENSUSE-SU-2024:10013-1

OPENSUSE-SU-2024:10498-1

RHSA-2014:0703

RHSA-2014_0703

USN-2245-1

Produtos afetados

Alt Linux

Red Hat

Ubuntu

Json-C

Referências · 31

• https://github.com/json-c/json-c/commit/64e36901a0614bf64a19bc3396469c66dcd0b015 · Correção
• http://oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html · Nota
• https://ubuntu.com/security/CVE-2013-6370 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6371 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-6370 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0175.html · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:10498-1 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1032311 · Nota
• https://suse.com/security/cve/CVE-2014-3683 · Nota
• https://ubuntu.com/security/notices/USN-2245-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-3200 · Nota
• https://osv.dev/vulnerability/CVE-2013-6371 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1032322 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6371 · Nota de Segurança